The invention discloses a method and system to classify Android malicious applications based on behavior characteristics. The method comprises: decompiling Android application samples that are input to obtain decompiled source files; subjecting the decompiled source files to syntactic analysis and characteristic extraction to obtain static characteristics and behavior characteristics of Android malicious applications; using a support vector machine classifier to classify Android applications to be classified according to the acquired static characteristics and behavior characteristics, therebydividing the Android applications to be classified into malicious Android applications or non-malicious Android applications. The system comprises a decompiling module, a syntactic analysis and characteristic extraction module and a classifying module. Behavior characteristics that mean something are introduced, and malicious Android applications are classified through the comprehensive application of the static analysis method, the syntactic analysis method and the support vector machine classifying method; shorter classifying time and improved efficiency are provided for malicious Android applications, and classifying accuracy is improved for malicious Android applications. The method and system are widely applicable to the field of data mining.